Binance Begins Buying Back $6.3B Stolen Altcoins in BTC ETH

Binance moves to replace stolen tokens after $6.3B breach

Exchange giant Binance has launched a coordinated effort to repurchase cryptocurrencies stolen in the October 29 security breach, saying it will use company reserves and market purchases to restore customer balances. In a company update, Binance said it has earmarked more than $6.34 billion to cover the incident, noting roughly $5 billion of those funds are already held in the same token types that attackers removed from exchange wallets.

What Binance is doing: reserves, SAFU and market buys

Binance confirmed it is tapping its Secure Asset Fund for Users (SAFU) along with existing cryptocurrency holdings to rebuild the exact denominations of the affected altcoins. Company executives say the reserves include sizable positions in Bitcoin and Ethereum, and that Binance will purchase the remaining stolen tokens through on-exchange liquidity and over-the-counter (OTC) desks.

Because some of the stolen tokens have limited liquidity, Binance cautioned that repurchases on public markets may take longer to complete. Separately negotiated OTC trades also require settlement and may not immediately appear as market orders, which could limit public visibility into the replacement activity.

Reserved funds versus active market buys

Binance’s $6.34 billion figure represents the total amount the company says it has set aside to address losses from the hack. Within that pool, approximately $5 billion already exists as the same token types that attackers moved out of Binance wallets. That distinction means the volume Binance still needs to buy on the open market could be smaller than the headline number suggests, but the firm has not published an itemized list of how much BTC, ETH or other assets it will liquidate to fund repurchases.

Attacker sales and market impact

On-chain tracking shows the hacker quickly converted large volumes of stolen altcoins into Ethereum after the breach, creating short-lived volatility across several token markets. Lookonchain and other chain trackers reported notable sales including:

• 7.02 million UNI (~$39.6M at time of sale)
• 7.77 trillion PEPE (~$31.7M)
• 217.5 million ENA (~$33.9M)
• 2.57 million LINK (~$26.1M)

Additional affected tokens named in reporting include AAVE, ONDO and WLD. The reported swaps generated roughly 70,480 ETH, valued near $158.3 million at the time of those transactions.

Binance’s pledge to replace stolen coins in their original denominations could push buying pressure into the market for specific tokens. However, because many repurchases may occur OTC, the replacement trades may be matched off-exchange and not always trigger equivalent order flow on public order books.

Investigations point to North Korean cybercrime group

Blockchain analytics firm Chainalysis has linked the breach to a hacking group known as TraderTraitor, a North Korean–linked actor previously tied to major crypto thefts. Chainalysis reported that funds from this exploit share transactional paths with assets taken during a separate September exploit at another exchange, reinforcing their assessment of a common operator or coordination between threat actors.

Complex laundering patterns and automated transfers

Investigators say the attackers initially moved approximately $500 million in stablecoins into a wallet intended to swap into assets less likely to be frozen. Approximately $325 million of those stablecoins were converted into about $285 million in ETH in a short time window, with the remainder shuffled through intermediary addresses. Chainalysis observed thousands of subsequent transfers and repetitive behaviors — for example, certain intermediary wallets receiving exactly 1 TRX before forwarding additional funds — which the firm interprets as signs of automated laundering infrastructure.

Frozen assets, cooperation with issuers and law enforcement

Binance says the company has already secured roughly $3 billion via cooperation with token issuers, investigators and law enforcement, with those assets remaining frozen or protected while recovery checks continue. The exchange has clarified that frozen or subject-to-recovery assets were excluded from its repurchase calculations.

Liquidity offers and partner support

Binance founder Changpeng Zhao (CZ) said the exchange’s Thai partner, Gulf, offered liquidity help during the crisis. CZ noted that, while Binance can independently cover the incident, strong partnerships that offer assistance in stressful moments have value beyond cash alone. Binance Thailand also reassured customers that user assets remain safe under independent custody arrangements and segregated cold wallets, although the local operator temporarily paused deposits and withdrawals for security checks.

Transparency, reporting and next steps

Binance has indicated it will continue purchasing the stolen tokens until affected balances are restored in fully matching quantities, and it plans to publish follow-up updates as the buyback program progresses. The company also said it will ultimately verify customer holdings via Proof of Reserves reporting once the recovery operations are complete.

Key unresolved details include the exact breakdown of repurchase volumes by token, the execution prices paid on market and OTC trades, and the specific amount of BTC or ETH that may be sold from Binance’s reserves to fund the repurchases. For market participants and affected users, the speed and transparency of those disclosures will be central to rebuilding confidence.

Market implications for crypto investors

From a market perspective, Binance’s approach seeks to limit customer losses without requiring users to take on asset basis differences or be forced into haircuts. Buying stolen altcoins back in their original denominations could support prices of individual tokens, at least temporarily, but OTC activity may mute visible market signals. Traders should watch liquidity conditions and potential price rebounds in the affected tokens, and stay alert for additional forensic reports from Chainalysis and law enforcement that could reveal more about the attacker’s laundering chain.

As investigations continue, exchanges, token issuers and the broader crypto community will be monitoring two parallel efforts: the technical tracing and freezing of illicit proceeds, and the practical replacement of customer assets via reserve-backed repurchases. Both streams will determine how quickly Binance can restore full service and public trust following one of the largest thefts in crypto history.